A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns and trackers through the `tracker-campaigns.php` script in Revive Adserver 6.0.7 and earlier. As a result, a low‑privileged user could link their trackers to campaigns owned by other managers on the same instance, leading to inconsistent ownership relationships.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Revive |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|---|
| Revive |
|
References
| Link | Providers |
|---|---|
| https://hackerone.com/reports/3780709 |
|
History
Fri, 26 Jun 2026 06:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Revive
Revive adserver |
|
| Vendors & Products |
Revive
Revive adserver |
Fri, 26 Jun 2026 03:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Authorization Bypass in Revive Adserver Tracker‑Campaign Linking |
Fri, 26 Jun 2026 01:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A bypass for CVE‑2026‑34913 exists with proper ownership validation that had not been applied to the reverse operation of linking campaigns and trackers through the `tracker-campaigns.php` script in Revive Adserver 6.0.7 and earlier. As a result, a low‑privileged user could link their trackers to campaigns owned by other managers on the same instance, leading to inconsistent ownership relationships. | |
| Weaknesses | CWE-284 | |
| References |
| |
| Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: hackerone
Published:
Updated: 2026-06-26T12:28:29.684Z
Reserved: 2026-06-06T15:00:09.779Z
Link: CVE-2026-50739
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-06-26T06:30:17Z